CVE-2026-102495

Analyzed Analyzed - Analysis Complete

Apache XmlSchema Stack Overflow via Recursive Schema Imports

Publication date: 2026-09-29

Last updated on: 2026-10-06

Assigner: Apache Software Foundation

Description

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-29

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-09-29

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102495

EUVD

EUVD-2026-88737

Affected Vendors & Products

Vendor	Product	Version / Range
apache	xmlschema	to 2.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves Apache XmlSchema allowing unlimited nesting of schema imports and includes. A malicious schema can trigger excessive recursion during parsing, leading to a stack overflow and causing a denial of service.

Detection Guidance

This vulnerability can be detected by checking the version of Apache XmlSchema in use. If you are running a version prior to 2.3.3, the system is vulnerable. Commands to check the version depend on your environment and how XmlSchema is integrated.

Impact Analysis

The vulnerability can disrupt services by crashing applications that parse schemas, leading to downtime or degraded performance. Systems using affected Apache XmlSchema versions are vulnerable to targeted attacks.

Compliance Impact

This vulnerability causes a denial of service by crashing the parser through stack overflow, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems. Downtime or service disruption may lead to compliance violations if critical systems become unavailable.

Mitigation Strategies

Immediately upgrade Apache XmlSchema to version 2.3.3 or later to fix the stack overflow issue caused by deep schema imports and includes.

Hi! I’m here to help you understand CVE-2026-102495. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70